getting "Cross-site auth request denied."

[ravibaskaran]

I am unable to login on the setup page. I am getting "Cross-site auth request denied."

[zhengr]

Root Cause：

The backend's is_allowed_auth_origin() function checks the request's Origin header against the whitelist loaded from GATEWAY_CORS_ORIGINS. Since that variable is never set, the whitelist is always empty, and every auth POST with an Origin header gets rejected with 403.

Fix
A files need to be patched:

1. start.sh — add the missing env var after the CORS_ORIGINS block
   After the existing export CORS_ORIGINS=... lines (around line 317), add:

Backend reads GATEWAY_CORS_ORIGINS (not CORS_ORIGINS) — keep them in sync
export GATEWAY_CORS_ORIGINS="$CORS_ORIGINS"

[ravibaskaran]

I wonder if I add as a variable in HF, will it work?

[zhengr]

Yes, it works like a workaround. But it is better to sync GATEWAY_CORS_ORIGINS and CORS_ORIGINS at code level.

[ravibaskaran]

Tried it. This is not working. According to chatgpt, these are the possible solutions. Please fix this
Solution 1 — Run backend + frontend on SAME origin. Solution hints
change API to relative API_URL=/api
add a reverse proxy in HF app /api/* → http://localhost:7860/*

Solution 2 — Move backend into the same HF Space
Solution 3 — Switch DeerFlow to token-based auth

Solutions that will NEVER work

• Adding CORS headers
• Adding HF variables
• Setting GATEWAY_CORS_ORIGINS
• Setting SameSite=None
• Changing cookie settings
• Changing ports
• Using HTTPS on your backend
• Because the browser blocks the request before it reaches your backend.